ai-connector: how to connect your local LLM to MISP - a new standard AI MISP module
LLMs are great for specific tasks in understanding (unstructured or even semi-structured) CTI reports.
However, very often one can not simply send out corporate CTI infos to the large public AI frontier models. Regulation, security and privacy concerns mandate local models.
Luckily, now some local LLM models are fully capable of understanding CTI Reports, understanding MISP EventReports, MISP events and they can even suggest the proper MISP tagging.
The new MISP "ai-connector" (https://github.com/MISP/ai-connector) is available and suitable for everyone who is capable for running a local ollama, vllm, LMStudio or similar. It gets even better: models such as qwen3.8 are extremely good at image as well as NLP tasks. The "ai-connector" module was written, tested and benchmarked against models such as qwen3.8 and is now part of the MISP eco-system.
In this workshop, participants will learn how to install it, configure it and make MISP "local-AI ready".
The workshop will first lay out the basic ideas, next it will show how to configure MISP so that it can talk with an LLM.
The participants will then be given a VM where they can experiment with local LLM integrations and the workflows.
Third module will be to have a group discussion on use-cases. The generic new "ai-connector" module lends itself to quickly implementing new use-cases for AI driven MISP interactions.
And the fourth module will be about how to implement new use-cases which build upon the "ai-connector".
Participants will leave the workshop with the know-how on local AI LLM integration into their private MISP instance.
Aaron Kaplan worked at cert.at for 12 years before reactivating his sole-proprietorship in 2020.
Since 2018 he has been fascinated by the possibilities, problems and pitfalls of AI for cybersecurity. He co-chairs the AI SIG at FIRST.org. Co-maintainer of IntelMQ.